What does it take to build a firewall.

Editors Note:

This paragraph written by Michael W. Lucas, was a lead into to a nice testimonial for a PFsense firewall.  For anybody that is in the IT consulting this first part is classic Dilbert.

Found in pfsense.org

My friends and co-workers know that I build firewalls. At least once a month someone says “My company needs a firewall with X and Y, and the price quotes I’ve gotten are tens of thousands of dollars. Can you help us out?”

Anyone who builds firewalls knows this question could be more realistically phrased as “Could you please come over one evening and slap together some equipment for me, then let me randomly interrupt you for the next three to five years to have you install new features, debug problems, set up features I didn’t know enough to request, attend meetings to resolve problems that can’t possibly be firewall issues but someone thinks might be the firewall, and identify solutions for my innumerable unknown requirements? Oh, and be sure to test every possible use case before deploying anything.

 

The inside story on how bandwidth controllers enforce fixed rate limits

By Art Reisman, www.netequalizer.com CTO

Art Reisman CTO www.netequalizer.com

Ever wonder how your ISP manages to control the speed of your connection? If so you might find the following article enlightening. Below we’ll discuss the various trade-offs use to control and break out bandwidth rate limits and the associated side effects with those techniques.

One of the simplest methods  for a bandwidth controller  to enforce a rate cap is by dropping packets.

When using the packet dropping method, the bandwidth controlling device will count the total number of bytes that cross a link during a second.  If the target rate is exceeded during any single second, then the bandwidth controller will drop packets for the remainder of that second. If for example the bandwidth limit is 1 megabit, and the bandwidth controller counts 1 million bits gone by  in 1/2 a second, it will then drop packets for the remainder of the second.  The counter will start counting over for the next second.

From most evidence we have observed,  rate caps enforced by many ISPs , use the drop packet method as it is the least expensive method supported on most basic routers.

So what is wrong with dropping packets  to enforce a bandwidth cap?

When a link hits a rate cap with packets  being dropped in mass , it can  reek havoc on their network.

For example, the standard reaction of a web browser, when it perceives web traffic is getting lost, is to retransmit the lost data. For an analogy of dropping packets,  lets take the case of a McDonald’s fast food restaurant.

Suppose the manager of the restaurant was told his bonus was based on making sure there was a never a line at the cash register. So whenever somebody showed up to order food , when all registers  were occupied, the manager would open a trap door conveniently ejecting   the customer back out into the parking lot. The customer, being extremely hungry, will come running back in the door (unless of course they die of starvation or get hit by a car) only to be ejected again. To make matters worse, lets suppose  a bus load of school kids arrive.  As  the kids file in to the McDonalds, the remaining ones on the bus have no idea their classmates  inside are getting ejected,  so they keep streaming in to the McDonalds.  Hopefully you get the idea, kids are piling up all over the place, while some are starving to death from the wasted energy of being tossed out of the restaurant.

When bandwidth shapers   deploy packet dropping  technology to enforce a rate cap, you can get the same effect as the trap door analogy in the McDonald’s.

Web browsers and other user based applications will beat their heads into the wall when they don’t get responses from their counterparts on the other end of the line. When packets are being dropped en mass,  the  network tends to spiral out of control until all the applications essentially give up. Perhaps you have seen this behavior while staying at a hotle with an underpowered internet link. Your connectivity will  alternate between working and hanging up completely for a minute or so during busy hours, obviously this  can be maddening.

The solution to shaping bandwidth on a network without causing gridlock requires Queing

Queuing packets

Queuing is the art of putting something in a line and making them wait before continuing on.  Obviously this is what banks , and fast food restaurants do. They plan enough staff on hand to handle the average traffic throughout the day and then  queue up their customers when they are arriving at a faster rate then they can fill  orders. The assumption with this model is that at some point during the day the McDonald’s will get caught up when the number of arriving customers and the lines will shrink away.

Another benefit of queuing is that wait times can be estimated by customers perhaps as they drive by and see the long line extending out into the parking lot and thus they will save their energy and not attempt to go inside, but what happens in the world of the Internet?

With queuing methods implemented, a bandwidth controller looks at the data rate of the incoming packets and if deemed to fast it will delay the packets in a queue. The packets will eventually get to their destination albiet somewhat later than expected. Packets on queue can pile up very quickly and without some help the link would saturate , computer memory to store the packets in the queue would also saturate and the Packets would eventually get dropped if they continued to come in at a faster rate then they were sent out.

Good news TCP to  the rescue.
Most internet applications use a service called TCP to handle their data transfers. TCP has developed intelligence to try and figure out the speed of the link for which it is sending data on and make adjustments. When the NetEqualizer bandwidth controller, queues a packet or two, the TCP controllers on the customer end point computers will sense the slower packets and back off the speed of the transfer. With just a little bit of queuing the sender slows down a bit and dropping packets can be kept to a minimum.


Queing inside the NetEqualizer

The Netequalizer bandwidth shaper uses a combination of queuing and dropping to get speed under control. Queing is the first option, but a sender that does not back off eventually their packets will get dropped. For the most part this combination of Queuing and dropping works well.

So far we have inferring a simple case of a single sender and a single queue, but what happens if you have gigabit link with 10,000 users and you want to break off 100 megabits to shared by 3000 users? How would a bandwidth shaper accomplish this. This is another area where a well designed bandwidth controller like the NetEqualizer seperates itself rom the crowd.

In order to provide smooth shaping for a large group of users sharing a link the NetEqualizer does several things in combination.

1) It keeps track of all streams and based on their individual speeds

2) the Netequalizer will use different queu delays on each stream.

3) Some streams that back off will get minimal queuing ,

4) other streams that do not back off may eventually have some of their packets dropped.

The net effect of the NetEq queing intelligence is that all users will experience steady response times and smooth service.


Notes about UDP and rate limits:

Some applications such as video do not use TCP to send data, they use a send and forget mechanism called UDP which has no built in back off mechanism. Without some higher intelligence, UDP packets will continue to be sent at a fixed rate , even if the packets are coming too quickly for the receiver.  The good news is that even most UDP applications also  have some way of measuring if their packets are getting to their destination , its just that with UDP the mechanism of synchronization is not standardized.

Finally there are those applications that just don’t care if the packets get to their destination. Speed tests and viruses send UDP packets as fast as they can regardless of whether the network can handle them or not. The only way to enforce a rate cap with such ill mannered application is to drop the packets.

NetEqualizer Software Update 4.0 — Carrier-Class Shaping

Continuing the constant evolution of the NetEqualizer line, we’re pleased to offer the most recent NetEqualizer software release – Carrier Class 4.0. In addition to providing the features and quality found in past NetEqualizer releases, among its many enhancements Carrier Class 4.0 will now support three times as many shaping buffers, translating into smoother shaping for up to tens of thousands of users.

For example, you will be able to take a one-gigabit pipe and break off 1,000 users into a subnet mask to share 100 megabits (with smoother results than current versions). Most routers that break out chunks of bandwidth use harsh rate control methods such as dropping packets when the limit is reached. Although there will be a small margin of error, the optimizations and techniques used to break off larger chunks of bandwidth and shape them smoothly without dropping packets rivals that of carrier class shapers sold for 10 times our cost.

The following features and enhancements will also be available with Carrier Class 4.0:

  • Full one- to 32-bit mask fields for hard limits  — You can now take any IP address and specify a mask in x.x.x.x/y format where y is the number of bits you wish to mask. All IP addresses in the masked range will receive the specified hard limit (Hard limits are individual rate limits for an IP address).
  • Pools support masks – You can now add members to a bandwidth pool using a mask field of the form x.x.x.x/y, Y can range from one to 32. The NetEqualizer will automatically add members of the range specified as they become active and retire them if they become inactive. This optimization will allow users to specify large ranges without overwhelming the system.
  • Full one- to 32-bit masking for traffic masking – You can now use the NetEqualizer masking function with odd numbered mask specifications, prior to this release only /24 and /16 masks were allowed.
  • Pool number displayed in active connection table – You can now see if a connection is part of a pool, the pool number will be displayed in the last column of the connection table.
  • Release 1.0 of our URL-based blocking feature – Now you can block a list of URL’s. This feature is commonly used by libraries and private institutions where there is a mandate to block particular recreational sites. In the initial release, customers need only supply a config file with all URLs by name that they wish to block and then hit the start button. In future releases, we will be contracting with providers that supply updated lists on a regular basis. There will be no charge to enable our URL-blocking feature, however there will likely be subscription charges to use third party URL lists.
  • Connection limit masks now fully supported – You can specify a connection limit mask of the form x.x.x.x/y where y is an int from one to 32. Prior to this release, only /24 and /26 were supported.
  • New Automatic detection of license overruns – The NetEqualizer will now automatically report any new license overruns. Any time you log into the GUI, a message will be displayed indicating how many license overruns you may have incurred since your last reboot. If you do see a license overrun, you should call support and see about upgrading your license.
  • New license levels available for enforcement in kernel
  • URL-based shaping

For more information on the Carrier Class 4.0 update, contact us at admin@apconnections.net or 303-997-1300.

Tech Tips, a script to block URLs with your NetEqualizer

# The following script can be used with your NetEqualizer to block a set of URL’s of your choosing

# save the script below into a file in the /art directory , we named ours blockstuff.pl

# then create a file with URL’s  you wish to block,one per line in the same directory as this perl script

# you’ll need a NetEqualizer version 4.0 or higher

 

#!/usr/bin/perl -w

#
$| = 1;

if(scalar(@ARGV) < 1){
print “Usage: $0 <file name with urls to block> \n”;
exit 1;
}

open (SPECIAL, “< $ARGV[0]“) || die “openning  url file in block stuff problem”;

while ($line=<SPECIAL> )
{
chomp($line);
print ” blocking $line \n”;

$search_phrase = $line;

if ( -e “/usr/bin/nslookup”)
{
print ” calling  nslookup for $search_phrase \n”;
$data=`/usr/bin/nslookup $search_phrase`;
open (LOGF, “>> /tmp/arblog”) || die “opening log file “;
# uses same log file as NetEq process not sure if this a good idea ?
print “$data data \n”;
chomp($data);
@foo= split(/[\s#]+/, $data);
$counter=6;
while ( $counter  < @foo)
{
$counter= $counter+1;
if ( exists $foo[$counter] ) {
if ($foo[$counter] =~ /(\d+)(\.\d+){3}/)
{
print ” $foo[$counter] is an IP \n”;
# ADD_CONFIG CONNECTION x.x.x.x/y val porti direction optional_commenta
system (“/art/ADD_CONFIG CONNECTION $foo[$counter]/32 1 0  1 $line “);
print LOGF “putting block on site $search_phrase IP $foo[$counter] \n”;
}
else
{
print LOGF “problem with version of NS lookup could not find valid IP for $search_phrase \n”;
}
}
}
}
else
{ print “need nslookup utility to run this command part of dnslib package debian\n”;
exit 1;
}
}
# While there’s a URL in our queue which we haven’t looked at …

University of British Columbia IT department chimes in on Layer 7 shaping and its fallacy

 

Editors notes: The following excerpt was pulled from the Resnet User Group Mailing list Oct 17 , 2009

Most subscribers to this user group are IT directors or adminstrators for large residence networks at various  universities. Many manage upwards of tens of thousands of Internet users.   If you are an ISP I would suggest you subscribe to  this list and monitor  for ideas.  Please note vendor solicitation is frowned upon on the Resnet list

As for the post below The first part of the post is Dennis’s recommendation for a good bandwidth shaper, he uses a carrier grade Cisco product.

The second part is a commentary on the fallacy of layer 7 shaping. No we do not know Dennis nor does he use our products , he just happens to agree with our philosophy after trying many other products.

 

Dennis OReilly <Dennis.OReilly@ubc.ca
reply-to Resnet Forum <RESNET-L@listserv.nd.edu> to RESNET-L@listserv.nd.edu date Sat, Oct 17, 2009 at 12:35 AM subject Re: Packet Shaping Appliance unsubscribe Unsubscribe from this sender

At 9:22 AM -0400 10/16/09, Brandon Burleigh wrote:

We are researching packet shaping appliance options as our current model is
end-of-life.  It is also at its maximum for bandwidth and we need to increase
our bandwidth with our Internet service provider.  We are interested in
knowing what hardware others are using on their Internet service for packet
shaping.  Thank you.

At the University of British Columbia we own and still use four PS10000’s.   A year ago we purchased a Cisco SCE 2020 which has 4 x 1G interfaces.  The SCE 2020 is approx the same price point as the PS10000.  There is also an SCE 8000 model which has 4 x 10G interfaces, also at a decent price point.

Oregon State brought the SCE product line to our attention at Resnet Symposium 2007.  A number of other Canadian universities recently purchased this product.

The SCE is based on P-Cube technology which Cisco acquired in 2004.

In a nutshell comparing the SCE to the PS10000:
- PS10000 reporting is much superior
- PS10000 and SCE are approx equal at ability to accurately classify P2P
- SCE is essentially a wire speed device
- SCE is a scalable, carrier-grade platform
- Installation of SCE is more complicated than PS10000
- SCE has some capability to identify and mitigate DoS and DDos attacks
- SCE handles asymmetric routing
- SCE has fine grained capabilities to control bandwidth

It is becoming more and more difficult over time for any packet shaping device like a Packetshaper, or a Procera, or an SCE to accurately classify P2P traffic. These days the only way to classify encrypted streams is through behaviorial analysis.  In the long run this is a losing proposition.  Thus, approaches like the NetEqualizer or script-based ‘penalty box’ approaches are better.   However, boxes like the SCE which have excellent capabilities to control bandwidth on a per user basis are also viable.  Otherwise the carriers wouldn’t be using these products.

Network World Blog missing the boat on Packeteer’s decline in revenue

The one thing bad about being a publicly traded company is that you cannot hide from your declining sales, in the following network world blog post and related comments ,the authors make some good points as to where and why they would choose Cisco Wan Optimization over Blue Coat and vice-versa. They also comment on all sorts of reasons why Blue Coat’s revenue in this area is declining , although they neglect one obvious reason.

Prices of bandwidth have fallen quite rapidly  over the last 10 years. In some larger metro areas  Internet access runs for as little as $300 per month for 10 megabits. The same link 10 years ago would have run close to $5000 per month or more. Despite falling bandwdith prices,  WAN optimization solutions from the likes Blue Coat, Cisco and Riverbed, remain relatively high.  Many ptential WAN optimization customers will  simply upgrade  their bandwidth rather than invest in new optimization equipment.  You would think that vendors would lower their prices to compete, and they are to some degree; however the complexity of their core solutions requires a mimumum price floor.   The factors that create the price floor on equipment are related to, methodology  of the internal technology, and sales channel costs,  and unfortunately these fixed cost factors cannot keep pace with falling bandwidth prices .

Our prediction is that WAN optimization devices will  slowly become a commodity with automated reduced complexity. One measure of the current complexity is   all the acronyms being tossed around describing WAN optimization. The sales pitches filled with accronyms clearly corrolate that perhaps these devices are just too complicated for the market to continue to use. They will become turn key simple and lower cost or die. No player is bigger than the Market force of cheaper bandwith.

 

http://www.networkworld.com/community/comment/reply/46590

How Does NetEqualizer compare to Mikrotik

Mikrotik is a super charged Swiss army knife solution, no feature is off limits on their product, routing , bandwidth control, layer seven filters, PPPoe, firewall they have it all. If I was going off to start a WISP with a limited budget, and could bring only one tool with me, it would be a Mikrotik solution. On the other hand the NetEqualizer grew up with the value equation of optimizing bandwidth on a network and doing it in a smart turn key fashion. It was developed by a wireless operator that realized high quality.easy to use bandwidth control  was needed to insure a profitable business.

Yes there is some overlap between the two,  over time the NetEqualizer has gone beyond their included auxillary features,  for example:  NetEqualizer has a firewall and  a network access control module; but the primary reason an operator would purchase a NetEqualizer still goes back to our core mission.  To keep their margins in this competitive business, they need to optimize their Internet trunk without paying an army of technicians to maintain a piece of equipment.


The following was part of a conversation with a customer who was interested in comparing Mikrotik queues to NetEqualizer Equalizinq. So take off your Mikrotik hat for a minute and read on about a different philosophy on how to control bandwidth.

Equalizing is a bit different than  Microtik, so we can’t make exact
feature comparisons.  NetEqualizer lets users run until the network
(or pool) is crowded and then slaps the heavy users for a very short
duration, faster than you  or I could do it  (if you tried). Do you
have the arcade game “wack a mole”  in Australia?  Where you hit the
moles on the head when they pop up out of the holes with a hammer?

The vision of our product was to allow operators to plug it in ,give
priority to short real time traffic when the network is busy, and to
leave it alone when shaping is not needed.

It does this based on connections not based on users (as per your question)

Suppose out of your 1000 users, 90 percent were web surfing , 5
percent watching youtube, and  20 percent were doing chat sessions
while doing youtube and web surfing, and another 20 percent were on
SKype calls while web surfing.

Based on the different demand levels of all these users it is nearly
impossible to divide the bandwidth evenly.

But, If the trunk was saturated, in the example above, the
NetEqualizer would chop down youtube streams (since they are the
biggest) leaving all the other streams alone. So instead of having
your network crash completely a few youtube videos would break up for
a few seconds and then when conditions abated they would be allowed to
run. I cannot tell you the exact allocations per user because we don’t
try to hit fixed allocations, we just put delay on the nasties until
the bandwidth usage overall drops back to 90 percent.  It is never the
same . And then we quickly take the delay away when things are better.

The value to you is that you get the best possible usage of your
network bandwidth without micro managing everything. There are no
queues to manage. We have been using this model with ISPs for 6 years.

If you do want to put additional rules onto users you can do that with
individual rate limits. Or VLAN limits.

Lastly if you have a very high priority client that must run video you
can give them an exemption if needed.

To control p2p you can use our connection limits as most p2p clients
overload APs with massive connections. We have a fairly smart simple
way to spot this type of user and keep them from crashing your network.
Created by APconnections, the NetEqualizer is a plug-and-play bandwidth control and WAN/Internet optimization appliance that is flexible and scalable. When the network is congested, NetEqualizer’s unique “behavior shaping” technology dynamically and automatically gives priority to latency sensitive applications, such as VoIP and email. Click here for a full price list. .

NetEqualizer provides Net Nuetrality solution for bandwidth control.

By Eli Riles NetEqualizer VP of Sales

This morning I read an article on how some start up companies are being hurt awaiting the FCC’s decision on Net Nuetrality.

Late in the day, a customer called and exclaimed, “Wow now with the FCC coming down  hard on technologies that jeopardize net neutrality, your business  must booming since you offer an excellent viable alternative” And yet  in face of this controversy, several of our competitors continue to sell deep packet inspection devices to customers.

Public operators and businesses that continue to purchase such technology are likely uninformed about the growing fire-storm of opposition against Deep Packet Inspection techniques.  The allure of being able to identify, and control Internet Traffic by type is very a natural solution, which customers often demand. Suppliers who sell DPI devices are just doing what their customer have asked. As with all technologies once the train leaves the station it is hard to turn around. What is different in the case of DPI is that suppliers and ISPs had their way with an ignorant public starting in the late 90’s. Nobody really gave much thought as to how DPI might be the villain in the controversy over Net Nuetrality. It was just assumed that nobody would notice their internet traffic being watched and redirected by routing devices. With behemoths such as Google having a vested interest in keeping traffic flowing without Interference on the Internet, commercial deep packet inspection solutions are slowly falling out of favor in the ISP sector. The bigger question for the players betting the house on DPI is , will it fall out favor in other  business verticals?

The NetEqualizer decision to do away with DPI two years ago is looking quite brilliant now, although at the time it was clearly a risk bucking market trends.  Today, even in the face of world wide recession our profit and unit sales are up for the first three quarters of 2009 this year.

As we have claimed in previous articles there is a time and place for deep packet inspection; however any provider using DPI to manipulate data is looking for a potential dog fight with the FCC.

NetEqualizer has been providing alternative bandwidth control options for ISPs , Businesses , and Schools of all sizes for 7 years without violating any of the Net Nuetrality sacred cows. If you have not heard about us, maybe now is a good time to pick up the phone. We have been on the record touting our solution as being fair equitable for quite some time now.

Using NetEqualizer Lite to prevent the 802.11 Hidden Terminal problem

Introduction

Of the numerous growing pains that can accompany the expansion of a wireless network, the hidden terminal problems is one of the most difficult problems to solve. Despite your best efforts, the communication breakdown between nodes can wreak havoc on a network, often leading to sub par performance and unhappy users.

What is a hidden terminal and why is it a problem for wireless networks?

An 802.11 wireless network in a normal, simple configuration consists of a central access point (AP) and one or more remote users – which are the individuals utilizing the computers and devices that constitute a node. Wireless transmission technology is such that if more than one remote user transmits data back to the AP at the same time, it is difficult for the AP to distinguish between the two talkers.

When the forefathers of 802.11 first designed the protocols for how a wireless network should prevent this problem, they assumed that all users and nodes would be in close proximity to the access point and could actually hear each other’s transmissions.

For example, say node A and node B are wireless laptops in an office building with one access point. Node A starts sending data to the access point at the same moment as node B. By design, node A is smart enough to listen at the exact moment it is sending data in order to ensure that it has the airwaves free and clear. If it hears some other talker at the same time, it may back off, or, in other cases, node B may be the one to back off. The exact mechanism used to determine the back off order is similar to right of way rules at a four-way stop. These rules of etiquette are followed to prevent a crash and allow each node to send its data unimpeded.

Thus, 802.11 is designed with a set of courtesies such that if one node hears another node talking, it backs off, going silent as to reduce the chaos of multiple transmissions at the same time. This should be true for every node in the network.

This technology worked fine until directional antennas were invented and attached to remote nodes, which allowed users to be farther away from an access point and still send and receive transmissions. This technology is widely available and fairly inexpensive, so it was adapted by many wireless service providers to extend Internet service across a community.

The impact of these directional antennas, and the longer distances it allows users to be from access points, is that individual nodes are often unable to hear each other. Since their antennas are directed back to a central location, as the individual nodes get farther away from the central AP, they also become farther apart from each other. This made it more difficult for the nodes to communicate. Think of a group of people talking while they stand around in an ever-expanding circle. As the circle expands away from the center, people get farther apart, making it harder for them to communicate.

Since it’s not practical to have each node point a directional antenna at all of the other nodes, the result is that the nodes don’t acknowledge one another and subsequently don’t back off to let others in. When nodes compete to reach the access point at the same time, typically those with the strongest signals, which are generally closest to the AP, win out, leaving the weaker-signaled nodes helpless and unable to communicate with the access point (see image below).

Your browser may not support display of this image.

When a network with hidden nodes reaches capacity, it is usually due to circumstances such as this, where nodes with stronger signals steal the airwaves and crowd out nodes with weaker signals. If the nodes with the stronger signals continue to talk constantly, the weaker nodes can be locked out indefinitely, leaving certain users without access to the network.

The degradation of the hidden node problem varies with time of day, as well as with who is talking at any moment. As a result, the problem is not in one place for long, so it is not easily remedied by a quick mechanical fix. But, fortunately, there is a solution.

How does a NetEqualizer solve the hidden node issue?

The NetEqualizer solution, which is completely compatible with 802.11, works by taking advantage of the natural inclination of Internet connections to back off when artificially restrained. We’ll get back to this key point in a moment.

Understanding the true throughput upper limit of your access point is key to the NetEqualizer’s efficiency, since the advertised throughput of an AP and its actual ceiling often vary, with most AP’s not reaching their full potential.

Once you have determined the peak capacity of the access point (done empirically through busy hour observation), you then place a NetEqualizer (normally the lower end NetEqualizer POE device) between the access point and it’s connection to the Internet. You then set the NetEqualizer to the effective throughput of the AP . This tells the NetEqualizer to kick into gear when that upper limit is reached.

Once configured, the NetEqualizer constantly (every second) measures the total aggregate bandwidth throughput traversing the AP. If it senses the upper limit is being reached, NetEqualizer will then isolate the dominating flows and encourage them to back off.

Each connection between a user on your network and the Internet constitutes a traffic flow. Flows vary widely from short dynamic bursts, which occur, for example, when searching a small Web site, to large persistent flows, as when performing peer-to-peer file sharing or downloading a large file.

By keeping track of every flow going through the AP, the NetEqualizer can make a determination of which ones are getting an unequal share of bandwidth and thus crowding out flows from weaker nodes.

NetEqualizer determines detrimental flows from normal ones by taking the following questions into consideration:

1) How persistent is the flow?
2) How many active flows are there?
3) How long has the flow been active?
4) How much total congestion is currently on the trunk?
5) How much bandwidth is the flow using relative to the link size?

Once the answers to these questions are known, NetEqualizer will adjust offending flows by adding latency, forcing them to back off and allow potentially hidden nodes to establish communications – thus eliminating any disruption. Nodes with stronger signals that are closer to the access point will no longer have the advantage over users based farther away. This is done automatically by the NetEqualizer, without requiring any additional programming by administrators.

The key to making this happen over 802.11 relies on the fact that if you slow a stream to the Internet down, the application at the root cause will back off and also slow down. This can be done by the NetEqualzier without any changes to the 802.11 protocol since the throttling is actually done independent of the radio. The throttling of heavy streams happens between the AP and the connection to the Internet.

Questions and Answers

How do you know congestion is caused by a heavy stream?

We have years of experience optimizing networks with this technology. It is safe to say that on any congested network roughly 5 percent of users are responsible for 80 percent of Internet traffic. This seems to be a law of Internet usage.2

Can certain applications be given priority?

NetEqualizer can give priority by IP address, for video streams, and in its default mode it naturally gives priority to Voice over IP (VoIP), thus addressing a common need for commercial operators.

How many users can the NetEqualizer POE support?

The NetEqualizer Lite can support approximately 200 users.

What happens to voice traffic over a wireless transmission? Will it be improved or impaired?

We have mostly seen improvements to voice quality using our techniques. Voice calls are usually fairly low runners when it comes to the amount of bandwidth consumed. Congestion is usually caused by higher running activities, and thus we are able to tune the NetEqualizer to favor voice.

How can I find out more about the NetEqualizer?

Additional information about the NetEqualizer can be found at our Web site.

How can I purchase an NetEqualizer for trial?

Customers in the U.S. can contact APconnections directly at 1-800-918-2763 or via e-mail at admin@APconnections.net. International customers outside of Europe can contact APconnections at +1 303-997-1300, extension 103 or at the e-mail listed above.

About APconnections

APconnections is a privately held company founded in July 2003 and based in Lafayette, CO. We develop cost-effective and easy-to-install and manage traffic shaping appliances. Our NetEqualizer product family optimizes critical network bandwidth resources for any organization that purchases bandwidth in bulk and then redistributes or resells that bandwidth to disparate users with competing needs.

Our goal is to provide fully-featured traffic shaping products that are simple to install and easy to use and manage. We released our first commercial offering in July 2003, and since then over 1000 unique customers around the world have put our products into service. Our flexible and scalable solutions can be found at ISPs, WISPs, major universities, Fortune 500 companies, SOHOs and small businesses on six continents.

Competing demands for network resources and congestion are problems shared by network administrators and operators across the globe. Low priority applications such as a large file download should never be allowed to congest and slowdown your VoIP, CRM, ERP or other high priority business applications. Until the development of APconnections’ NetEqualizer product family, network administrators and operators who wanted to cost-effectively manage network congestion and quality of service were forced to cobble together custom solutions. This process turned a simple task into a labor intensive exercise in custom software development. Now, with the NetEqualizer product family from APconnections, network staff can purchase and quickly install cost-effective turnkey traffic shaping solutions.


1 Nodes are defined as any computer or device that is within a network. In this white paper, the term “user” will refer to the individual or group utilizing these computers or devices and could effectively be interchanged with the term “node”. In addition, the term “talker” will at times be used to refer to nodes that are sending data.

How much money does a NetEqualizer Save an ISP or cable internet operator?

Just got this e-mail in unsolicited from a customer. We hear this all the time.

The context of the thread was that our customer had just gotten back from a convention and had told a couple of their peer companies (Canadian Cable Operators) about the NetEq and his improved margins.

Ya I’m sure they have to go home and pitch the deal to the management but
they are soooo wasting bandwidth.

6500 customers using 250M sustained

We on the other hand have 4000 using 60M sustained

Crazy!

Burstable Internet Connections — Are They of Any Value?

A burstable Internet connection conjures up the image of a super-charged Internet reserve, available at your discretion during a moment of need, like pushing the gas pedal to the floor to pass an RV on a steep grade. Americans find comfort knowing that they have that extra horsepower at their disposal. The promise of power is ingrained in our psyche, and is easily tapped into when marketing an Internet service. However, if you stop for a minute, and think about what is a bandwidth burst, it might not be a feature worth paying for in reality.

Here are some key questions to consider:

  • Is a burst one second, 10 seconds, or 10 hours at a time? This might seem like a stupid question, but it is at the heart of the issue. What good is a 1-second burst if you are watching a 20-minute movie?
  • If it is 10 seconds, then how long do I need to wait before it becomes available again?
  • Is it available all of the time, or just when my upstream provider(s) circuits are not busy?
  • And overall, is the burst really worth paying for? Suppose the electric company told you that you had a burstable electric connection or that your water pressure fluctuated up for a few seconds randomly throughout the day? Is that a feature worth paying for? Just because it’s offered doesn’t necessarily mean it’s needed or even that advantageous.

While the answers to each of these questions will ultimately depend on the circumstances, they all serve to point out a potential fallacy in the case for burstable Internet speeds: The problem with bursting and the way it is marketed is that it can be a meaningless statement without a precise definition. Perhaps there are providers out there that lay out exact definitions for a burstable connection, and abide by those terms. Even then we could argue that the value of the burst is limited.

What we have seen in practice is that most burstable Internet connections are unpredictable and simply confuse and annoy customers. Unlike the turbo charger in your car, you have no control over when you can burst and when you can’t. What sounded good in the marketing literature may have little practical value without a clear contract of availability.

Therefore, to ensure that burstable Internet speeds really will work to your advantage, it’s important to ask the questions mentioned above. Otherwise, it very well may just serve as a marketing ploy or extra cost with no real payoff in application.

Update: October 1, 2009

Today a user group published a bill of rights in order to nail ISPs down on what exactly they are providing in their service contracts.
ISP claims of bandwidth speed.

I noticed that  in the article, the bill of rights, requires a full disclosure about the speed of the providers link to the consumers modem. I am not sure if this is enough to accomplish a fixed minimus speed to the consumer.  You see, a provider could then quite easily oversell the capacity on their swtiching point. The point where they hook up to a backbone of other providers.  You can not completely regulate speed across the Internet, since by design providers hand off or exchange traffic with other providers.  Your provider cannot control the speed of your connection once it is off their network.

Posted by Eli Riles, VP of sales www.netequalizer.com.

When is it time to add more bandwidth to your network?

We recently received an e-mail regarding this question from a customer, here is the basic dialogue with our answer below.

It occurred to me today…..pre netequalizer, I’d know that it was time to upgrade our network bandwidth by watching the network traffic graphs.  If there were periods of the day that the connection was maxed out it was a good sign that more bandwidth was needed.

Now that our traffic is running through netequalizer, with the threshold limit and then slowing of user connections beyond that point, we’ll not see the graph max out any more will we?  And if we did ever see that, we’d be way past the point of needing more bandwidth, because it would mean that our link was so saturated that netequalizer couldn’t slow down enough traffic fast enough to avoid that situation.

Answer: We actually do have systems that run very close to pegged(Max) for
hours at a time without complaint. Generally we would suggest waiting
until user perception for the speed of normal sized web pages and short
e-mails is perceived as slow. NetEqualizer does a very good job of allowing your network to run close to capacity without experiences adverse side effects so in essence it would be premature to add more bandwidth based on hitting peak usage.

Note: If you ask your sales rep for your local bandwidth provider if you should purchase more bandwidth, they will almost always recommend adding more solve almost ato ny issue on your network. Your provider whether it be Quest, Comcast, Time Warner or a host of other local providers,  most likely has a business model where they grow profit by selling bandwidth; hence their sales staff really is not incented to offer alternatives. Occasionally when it is physically impossible to bring more bandwidth to your business they will relent and offer a referal for a bandwidth opimization company.

NetEqualizer reaches 5 Gigabit milestone, strengthens market lead in bandwidth controller price performance.

NetEqualizer reaches 5 Gigabit milestone, strengthens market lead in
bandwidth controller price performance.

LAFAYETTE, Colo., Sep 15 APconnections, a leading supplier of
bandwidth shaping products, today announced  the addition of a
5-gigabit  model  to their NetEqualizer brand of traffic shapers. The
initial release will also be able to shape 40,000 simultaneous
Internet users.

“Prior to this release, our largest model, was rated for one gigabit,”
said Eli Riles, APconnections vice president of sales. “Many of our
current customers liked our technology, but just needed a higher-end
machine.   The price performance of our new traffic shaping appliance
is unmatched in the industry”

In its initial release, the five-gigabit model will start at  $11000
USD. For more information, contact APconnections at 1-800-918-2763 or
via email at sales@netequalizer.com.

The NetEqualizer is a plug-and-play bandwidth control and WAN
optimization appliance. NetEqualizer technology is deployed at over
3000 businesses and institutions around the world. It is used to speed
up shared Internet connections for ISP’s , Libraries, Universities,
Schools and Fortune 500 companies.

APconnections is a privately held company founded in 2003 and is based
in Lafayette, Colorado.

Contact: APconnections, 1-800-918-2763 http://www.apconnections.net/

http://www.netequalizer.com/

Special thanks to Candela Technologies www.candelatech.com and their
Network Emulation laboratories for making this release possible.

Why is NetEqualizer the low price leader in Bandwidth Control

Recently we have gotten feed back from customers that stating they almost did not consider the NetEqualizer because the price was so much less than solutions  from the likes of: Packeteer (Blue Coat), Allot NetEnforcer and Exinda.

Sometimes low price will raise a red flag on a purchase decision, especially when the price is an order of magnitude less than the competition.

Given this feed back we thought it would be a good idea to go over some of the major cost structure differences betwen APconnections maker of the NetEqualizer and some of the competition.

1) NetEqualizer’s are sold mostly direct by word of mouth. We do not have a traditional indirect sales channel.

- The down side for us as a company is that this does limit our reach a bit.  Many IT departments do not have the resources to seek out new products on their own, and are limited to only what is presented to them.

- The good news for all involved is selling direct takes quite a bit of cost out of delivering the product. Indirect  sales channels need to be incented to sell,  Often times they will steer the customer toward the highest commission product in their arsenal.  Our  direct channel eliminates this overhead.

-The other good thing about not using a sales channel is that when you talk to one of our direct (non commissioned) sales reps you can be sure that they are experts on the NetEqualizer. With a sales channel a sales rep often sells many different kinds of products and they can get rusty on some of the specifics.

2) We have bundled our Manufacturing with a company that also produces a popular fire wall. We also have a back source to manufacture our products at all times thus insuring a steady flow of product without the liability of a Manufacturing facility

3) We have never borrowed money to run Apconnections,

- this keeps us very stable and able to withstand market fluctuations

- there are no greedy investors calling the shots looking for a return and demanding higher prices

4) The NetEqualizer is simple and elegant

- Many products keep adding features to grow their market share we have a solution that works well but does not require constant current engineering

Five Key Marketing Tips for Entrepreneur and Tech Start-Up Companies

By Art Reisman, CEO and co-founder of APconnections, makers of the NetEqualizer

Aside from a few freakish start ups, very few products will take off with out some form of promotion. However, since founding APconnections in 2003,  we’ve learned that marketing can be a double-edged sword. Over time, we’ve been able to build upon both our successes as well as mistakes, coming up with a few dos and don’ts of marketing a tech start up along the way.  Here are a few of the key points:

1) Make sure your marketing company has skin in the game

Most marketing firms are staffed by people who went to college and took soft course work, meaning they were not into the black and white of the scientific method.  Perhaps they had a course or two with this emphasis, but it’s not likely to be as ingrained as perhaps a physics or psychology major whose course work included extensive lab experiments showing cause and effect.

Although some creative skill is necessary to be a good marketing person, the down side is most people in this industry tend to remain artsy and vague with how they can measure results. When negotiating with marketing companies  (or people), we came up with a simple formula to measure results and provide a metric which was easy to quantify — hits to the web site.

In our case it was very simple.  We had a baseline established already and we were only going to change one variable  — marketing.  Hence, it would be easy to tie any increase in web traffic to a marketing effort.  To make sure that  any benefit of doubt went to our marketing firm, we decided  any increase in web traffic, regardless of cause, would be credited to their efforts.

Once we tied marketing fees exclusively to a metric that could be measured, we were able to eliminate several marketing firms, many of which headed for the hills never to be seen from again.

2) Round two — good web traffic verses bad traffic

Having solved the problems of paying for results, we came across another hurdle. We’ll just call it good traffic verses bad traffic. The easiest way to describe this is by example.

Our product, the NetEqualizer, is meant to  be sold to commercial operators and businesses where there is Internet congestion.   An obvious catch-all key phrase to lead with in marketing literature would be, “speed up your Internet connection”.

If you throw this type of tag line into a generic advertisement to a broad audience,  perhaps 99 percent of the people who follow up on it will be home users, kids playing World of Warcraft, looking for some tool they can load up on their Windows machine for $25. In other words, the majority of these follow ups would certainly not be our target market.

What we found was that our consignment-based marketing people were not  screening this traffic out. We believe this disconnect  goes back to their inability to use the scientific method to control variables. So, as you can imagine, we initially had a flood of inquiries outside our target market which turned out to be a big waste of our time. The solution to ending this march of unqualified leads was to put a higher price in any literature or teasers and to emphasize our product was for commercial users etc. So, instead of just promoting the potential to speed up Internet traffic, we made NetEqualizer’s starting price clear from the beginning.

3) Make sure your marketing people understand  how your product is used and take an honest interest in it

We would spend hours explaining our target market and details about our product only to find out that this information would go in one ear and out the other. When we finally found somebody who had the capacity to understand our product we doubled their pay.  It was worth it in time saved.

4) Consignment ads only

Once you have decided on an effective message in an advertisement, follow this rule — Never pay a dime up front to bolster your ad’s exposure just to increase your market presence. Yes market presence is good, but unless you can measure this in terms of some metric,  just don’t do it.

Any advertisement you place should only charge you when somebody clicks on it. I am not talking about discount coupons for a local business here. I am talking about selling a product to a broad national or global audience. This edict pretty much rules out print advertising. To be fair, I have heard from other CEO’s of tech companies that if you stick with print ads and spend a good deal of cash, they will pay-off, but this shouldn’t be your first or only option. Until you have exhausted every conceivable outlet for consignment based advertising, why risk digging any dry wells?

Our experience with six weeks of continuous quarter- and half-page ads in tech magazines brought zero impact. Nothing. Nada. We measured no increase in web hits. Maybe we did increase awareness, but awareness has no value if you go bankrupt establishing it and don’t see any returns.

Of course, while there are no guarantees for successful marketing, these four tips have been tested and proven effective at APconnections over the past several years.

5) Avoid being strung out

Perhaps this tip should be number one as it is essential to understand how companies will string you out. As a start up, with an idea you will likely get conditional inquiries. Can you product do “this”, can we we customize it ? Often times the more questions, the more uncertain the customer is about their own business. You MUST establish the customers willingness to pay before getting  wrapped up in the promise of future sales. Obviously you cannot demand payment on a first consultation with a prospect, but this is a good time to  set some expecations that your time is valuable. I bring this up because at this very moment I am in talks with a large customer interested in our product that has been asking questions for over a month. This morning I basically told  them  (nicely)I will continue the conversation if and when they purchase their first unit from us. For all I know I am dealing with an underling that has time on his hands but no ability to influence a purchase decision. Getting them to purchase something is a big first step toward qualification. If you fail to master qualification you will find yourself borrowing money from relatives to pay your rent or out of business very quickly.

I’d also suggest you look at our tips for using google ads.

Another great site for start ups is entrepreneurship.org

Good luck!